Security researchers have demonstrated a Microsoft Entra attack technique that can continue capturing passwords even after affected users reset them.
Researchers at Varonis Threat Labs call the technique TrustSink. It abuses Entra’s support for external multifactor authentication providers. An attacker who has already compromised a privileged administrator account could use that access to place a convincing password prompt inside the normal Microsoft sign-in process.
In Varonis’s test environment, users could complete the sign-in normally while the rogue provider collected a password entered during the MFA stage. Resetting the stolen password did not remove the malicious provider, which meant it could capture the replacement password the next time the user signed in.
The attack requires administrator access
TrustSink does not provide an initial way into a Microsoft Entra environment.
An attacker must first compromise an account with enough privileges to change the organization’s authentication configuration. Varonis says its demonstration required access that could register an external authentication method and create the related application components.
External authentication methods are a legitimate Entra feature that allows organizations to use third-party services for multifactor authentication. The research shows how that trust could be abused after an attacker gains control of the configuration.
The rogue provider can display what appears to be another Microsoft password request during authentication. If the user enters a password, the provider captures it and sends a valid signed response back to Entra. The login can then finish without an obvious error.
A password reset alone is not enough
The persistence of the rogue provider changes how organizations need to respond.
Varonis recommends disabling the unauthorized external authentication method before resetting affected passwords. Administrators should also remove associated application registrations, service principals, permissions and signing credentials.
Sign-in logs can then be used to identify accounts that authenticated through the provider so their credentials can be reset and their activity reviewed.
Security teams should also watch for unexpected changes to Entra’s Authentication Methods policy, unfamiliar external authentication providers, suspicious application registrations and unknown issuers appearing in sign-in records.
Varonis recommends limiting standing access to highly privileged administrator roles and using phishing-resistant authentication methods such as FIDO2 security keys or Windows Hello for Business where appropriate.
The order of recovery matters. If the rogue authentication provider remains in place, a newly changed password could be exposed the next time the user signs in.
Leave a Reply